TL;DR: Akeyless says leaked secrets, static privileges and delayed rotation keep software supply chains exposed because credentials embedded in code, configuration files and logs remain valid long enough for attackers to abuse them. The real weakness is governance that still treats secrets as durable assets instead of short-lived access material.
At a glance
What this is: This is an analysis of how secret sprawl and static privileges create persistent attack paths in software supply chains.
Why it matters: It matters because identity teams have to govern secrets as lifecycle-bound access artefacts, not as reusable conveniences that can safely linger across repositories, build systems and runtime connections.
👉 Read Akeyless' analysis of secrets sprawl and static privileges in supply chains
Context
Software supply chain attacks exploit trust in code, build and update paths. In this article, the core governance gap is not just compromise of a repository or pipeline, but the fact that secrets and privileges are often created once and then left in place long enough to be copied, reused or stolen.
Secret sprawl means credentials are embedded across code, configuration files and logs instead of being centrally governed. When that happens, the same identity material can move from development convenience into an attacker’s persistence path, which turns access management into a supply chain security issue.
The article frames this as a secrets management problem for software delivery environments, especially where human-to-machine and machine-to-machine access depend on long-lived credentials. That starting position is typical in modern DevOps environments, where speed often outpaces lifecycle control.
Key questions
Q: What breaks when secrets are exposed in a software supply chain incident?
A: The immediate break is not just code integrity, but credential integrity. Exposed tokens and cloud keys can let an attacker reuse trusted identities, reach build systems, or access infrastructure that was never meant to be exposed through package updates. Once that happens, the incident stops being a single-package problem and becomes a governance failure across CI, secrets management, and downstream trust boundaries.
Q: Why do static privileges increase supply chain compromise risk?
A: Static privileges increase risk because a stolen or guessed secret can remain valid long after the moment it was issued. In supply chain environments, that gives attackers enough time to abuse repository or build access, modify code, or wait for a downstream release path. Short-lived credentials reduce that abuse window materially.
Q: How can teams tell whether secret rotation is actually reducing risk?
A: Teams should look at whether a rotated secret was ever exposed at runtime, whether it still works in downstream systems, and how quickly it can be revoked everywhere it matters. Rotation only reduces risk if the old credential cannot be reused and the replacement is not injected as another durable secret. Otherwise, the attack window remains open.
Q: What should organisations do when software delivery depends on long-lived secrets?
A: They should move high-risk connections toward just-in-time access and governed policy-based issuance. If the workflow still requires standing credentials, teams should limit their scope, reduce their lifetime and tie them to explicit approval and expiry. The goal is to make stolen access expire faster than an attacker can use it.
Technical breakdown
How secret sprawl turns code and logs into access paths
Secret sprawl is the uncontrolled distribution of keys, certificates and credentials across code, configuration files, build artefacts and logs. The technical problem is not only exposure, but reusability: once a secret is embedded in one place, it often gets copied into others and can persist in systems developers do not routinely audit. In a software supply chain, that means the same credential can be harvested from source control, CI output or debugging logs and then used to reach downstream services. The result is a long-lived identity artifact with multiple discovery points and no single revocation boundary.
Practical implication: treat source code, logs and configuration files as secret discovery surfaces and remove credentials from all three.
Why static secrets create an abuse window in supply chains
Static secrets are long-standing credentials that remain valid until someone explicitly rotates or revokes them. In supply chain environments, that creates an abuse window because an attacker only needs one successful theft or guess to obtain durable access. Rotation shortens that window, but if rotation is infrequent or manual, the secret can remain exploitable long after exposure. This is why long-lived credentials are structurally different from ephemeral access: they convert a single leak into an extended opportunity for unauthorized repository access, code tampering or malware insertion.
Practical implication: replace long-lived secrets with short-lived credentials wherever repository and build access depends on them.
How just-in-time access changes human-to-machine and machine-to-machine trust
Just-in-time access changes the trust model by issuing credentials on demand for a specific task and revoking them when the session ends. That matters in human-to-machine and machine-to-machine flows because the connecting identity receives only the minimum privileges needed for that action, not a durable secret that can be reused later. The security gain comes from collapsing the usable lifetime of the credential, which narrows the window for theft and reuse. In practical terms, the control shifts from protecting a standing secret to governing issuance, scope and expiry.
Practical implication: design access paths so credentials expire automatically after the approved task or connection completes.
Threat narrative
Attacker objective: The attacker aims to gain trusted access to the software delivery chain so they can modify code, insert malware or create further downstream compromise.
- Entry begins when attackers obtain leaked secrets from code, configuration files, logs or exposed repositories in the software supply chain.
- Credential access follows when static secrets, including keys or OAuth tokens, are reused before they are rotated or revoked.
- Impact occurs when the attacker uses that valid access to compromise source code, embed malware or extend access further down the supply chain.
Breaches seen in the wild
- CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Secret sprawl is a lifecycle problem, not just an exposure problem. The issue is that credentials are distributed into places where governance no longer sees them as identity material. Once a secret exists in code, logs or repository history, it behaves like unmanaged NHI access, not like a controlled asset. Practitioners should treat sprawl as a lifecycle failure that expands the attack surface across development and delivery.
Static privilege is the governance assumption that breaks supply chain defence. The model assumes a secret will stay valid long enough to support work but not long enough to be abused. That assumption fails when attackers can steal, buy or reuse a credential after it has escaped into the wild. The implication is that security teams need to think in terms of credential half-life, not just credential strength.
Ephemeral credential trust debt: supply chains accumulate risk every time a workflow depends on a credential that is reusable after the task ends. The longer that debt remains unpaid, the more likely it is that one leaked secret becomes a lasting foothold. In NHIMG terms, the decisive question is not whether a secret is strong, but whether its lifetime matches the task that depends on it.
Human-to-machine and machine-to-machine access deserve the same lifecycle discipline. The article correctly points out that JIT access can reduce risk in both patterns because the identity gets only the necessary privilege for a short period. That makes issuance controls and automatic expiry more important than static vault presence. Practitioners should align software delivery access with the same governance logic they apply to other short-lived privileged sessions.
Secrets management is becoming a supply chain integrity control. The reason is simple: if an attacker can reach the trust fabric through reused credentials, they can affect code integrity without defeating the application itself. This pushes identity governance deeper into build and release security, where access scope and expiry now influence software trust. Security teams should reclassify secrets governance as part of software supply chain resilience, not a separate vaulting exercise.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe, according to the State of Secrets Sprawl 2026.
What this signals
Ephemeral credentials reduce one part of the problem, but they do not fix secret sprawl on their own. The real governance issue is that credentials keep showing up where they were never meant to live, which means the programme has to control discovery, not just rotation. According to the State of Secrets Sprawl 2026, internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), which is a reminder that private development spaces are not inherently safe.
Supply chain access has to be governed as a lifecycle problem. Teams should assume that any reusable credential eventually becomes discoverable somewhere in the delivery stack. That pushes identity governance toward automatic expiry, scoped issuance and repository hygiene as a combined control set.
For practitioners
- Map secret sprawl across delivery paths Inventory where secrets appear in source repositories, build logs, configuration files and CI/CD variables, then classify each location by revocation risk and exposure duration.
- Shorten credential lifetime aggressively Replace standing secrets with dynamic or just-in-time credentials wherever pipelines, deployment tooling or service connections can tolerate on-demand issuance.
- Automate rotation for exposed secrets Set rotation triggers for any credential that appears in code, logs or tickets, and require revocation before the next deployment cycle can reuse it.
- Separate development convenience from production trust Let developers obtain the access they need through governed policies rather than through embedded credentials that remain valid across multiple systems.
Key takeaways
- Secret sprawl turns repositories, logs and configuration files into ungoverned access surfaces that attackers can search and reuse.
- Static privileges create an abuse window that persists until rotation or revocation removes the credential from circulation.
- Just-in-time access and automatic expiry reduce the time attackers have to exploit leaked credentials in supply chains.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centres on leaked secrets in code, logs and repositories. |
| NHI-07 — Long-Lived Secrets | Static privileges and delayed rotation are the core exposure described here. | |
| NHI-05 — Overprivileged NHI | The article warns that standing privileges give attackers too much time and scope after leakage. | |
| Recommendation — Scan repositories and logs for exposed secrets and revoke any credential found in delivery paths. Replace long-lived secrets with short-lived credentials wherever supply chain workflows depend on access. Constrain NHI permissions to the minimum task scope and remove standing access where possible. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Rotation and revocation of credentials are central to the article's mitigation model. |
| Recommendation — Apply IA-5 to enforce credential rotation, expiry and revocation for supply chain secrets. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The attack pattern described begins with credential theft and ends with supply chain impact. |
| Recommendation — Map leaked-secret scenarios to TA0006 and TA0040 to prioritise credential theft and tampering risks. | ||
Key terms
- Secrets Sprawl: The uncontrolled proliferation of sensitive credentials, API keys, tokens, passwords, certificates, across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web.
- Static Secret: A secret, such as an API key or password, that does not change automatically over time. Static secrets require manual or scheduled rotation and represent a higher security risk than dynamic secrets or managed identities.
- Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
- Software Supply Chain: A software supply chain is the set of tools, identities, dependencies, and processes that turn source code into deployed software. Because it relies on automation and privileged machine identities, it becomes a governance problem when access, signing, and deployment controls are too broad.
What's in the full article
Akeyless' full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanation of how leaked secrets move from repositories into supply chain compromise paths
- Operational description of how encrypted vaulting supports secret storage across hybrid and multicloud environments
- Specific mechanics of high-frequency rotation and just-in-time access for human-to-machine and machine-to-machine flows
- How a centralised secrets platform surfaces unusual secret use for alerting and investigation
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 17, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org